CVE-2026-42004: Powerdns Dnsdist

Low severity, CVSS 3.7. EPSS: 0.2% chance of exploitation in the next 30 days.

An attacker can send a crafted EDNS OPT record that will be ignored by DNSdist’s filtering rules, but will be rewritten as a valid OPT record when EDNS Client Subnet is inserted, causing the backend to see the EDNS option(s) that DNSdist did not filter.

Affected products

• Powerdns Dnsdist: from 1.9.0, before 1.9.15 (fixed in 1.9.15); from 2.0.0, before 2.0.7 (fixed in 2.0.7)

Published 2026-06-25. Last modified 2026-06-25.